Wuzhicms vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2023-52064 Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the $keywords parameter at /core/admin/copyfrom.php.Critical 9.8 · Jan 10, 2024
• CVE-2023-46482 SQL injection vulnerability in wuzhicms v.4.1.0 allows a remote attacker to execute arbitrary code via the Database Backup Functionality in the coreframe/app/daCritical 9.8 · Nov 1, 2023
• CVE-2020-36037 An issue was disocvered in wuzhicms version 4.1.0, allows remote attackers to execte arbitrary code via the setting parameter to the ueditor in index.php.High 8.8 · Aug 11, 2023
• CVE-2020-21325 An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the set_chache method of the function\common.func.php file.High 8.8 · Jun 20, 2023
• CVE-2020-20413 SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checktitle() function in admin/content.php.Critical 9.8 · Jun 20, 2023
• CVE-2021-41654 SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/paCritical 9.8 · Jun 16, 2022
• CVE-2022-27431 Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php.Critical 9.8 · May 3, 2022
• CVE-2020-28145 Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensitivHigh 7.5 · Oct 12, 2021
• CVE-2020-20124 Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \attachment\admin\index.php.High 8.8 · Sep 28, 2021
• CVE-2020-20122 Wuzhi CMS v4.1 contains a SQL injection vulnerability in the checktitle() function in /coreframe/app/content/admin/content.php.Critical 9.8 · Sep 28, 2021
• CVE-2020-24930 Beijing Wuzhi Internet Technology Co., Ltd.High 8.1 · Sep 27, 2021
• CVE-2020-19551 Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php, which when uploaded can cause remote code executiong.High 8.8 · Sep 21, 2021
• CVE-2021-40674 An SQL injection vulnerability exists in Wuzhi CMS v4.1.0 via the KeyValue parameter in coreframe/app/order/admin/index.php.Critical 9.8 · Sep 20, 2021
• CVE-2021-40670 SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords iparameter under the /coreframe/app/order/admin/card.php file.Critical 9.8 · Sep 16, 2021
• CVE-2021-40669 SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under the coreframe/app/promote/admin/index.php file.Critical 9.8 · Sep 16, 2021
• CVE-2020-18877 SQL Injection in Wuzhi CMS v4.1.0 allows remote attackers to obtain sensitive information via the 'flag' parameter in the component '/coreframe/app/order/admin/High 7.5 · Aug 20, 2021
• CVE-2018-20572 WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue toCritical 9.8 · Dec 28, 2018
• CVE-2018-18712 An issue was discovered in WUZHI CMS 4.1.0.High 8.8 · Oct 29, 2018
• CVE-2018-18711 An issue was discovered in WUZHI CMS 4.1.0.High 8.8 · Oct 29, 2018
• CVE-2018-14472 An issue was discovered in WUZHI CMS 4.1.0.High 7.2 · Jul 20, 2018
• CVE-2018-11722 WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the 'code' parameter, because 'UC_KEY' is hard coded.Critical 9.8 · Jun 5, 2018
• CVE-2018-11528 WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI.Critical 9.8 · May 29, 2018
• CVE-2018-11493 An issue was discovered in WUZHI CMS 4.1.0.High 8.8 · May 26, 2018
• CVE-2018-10312 index.php?m=member&v=pw_reset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member.High 8.8 · Apr 23, 2018
• CVE-2018-9927 An issue was discovered in WUZHI CMS 4.1.0.High 8.8 · Apr 10, 2018